Join Log in
Score:0
yolenoyer avatar Server

Is it secure to talk to a local API with http, when the public endpoint is https?

ng flag
yolenoyer

Context

I have a server setup which looks like this:

  • An Apache server is listening for example.com;
  • Public port 80 is redirected to 443;
  • Public port 443 is forwarded to a Symfony project;
  • On the same machine, there is a local API server written in Rust, which is listening to http://127.0.0.1:8030 (no SSL/TLS support);
  • The local API is able to respond some sensitive data, like JWT authentication tokens;
  • https://example.com/api is a proxy to the local API server (ProxyPass and ProxyPassReverse, see the Apache config below), in order to:
    • expose the API to the final user with SSL/TLS support,
    • and to be able to send XHR javascript requests to it, from the public Symfony website.

Note: I made this setup with a proxy for the local API because I had many troubles with CORS rules; but this is not the subject of my question (I guess there are far, far better setups).

Question

Can this setup be considered as secure, or should it be a good point to add SSL/TLS support for the local API?

Apache configuration, a bit simplified

<VirtualHost *:80>
   ServerName example.com
   Redirect / https://example.com
</VirtualHost>

<VirtualHost *:443>
    ServerName example.com

    DirectoryIndex /index.php

    ProxyPass /api http://127.0.0.1:8030/
    ProxyPassReverse /api http://127.0.0.1:8030/

    SSLEngine on
    SSLProtocol -ALL +TLSv1.2 +TLSv1.3
    SSLCompression off
    SSLCertificateFile /etc/letsencrypt/live/example.com/cert.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
    SSLCACertificateFile /etc/letsencrypt/live/example.com/fullchain.pem

    DocumentRoot /var/www/html/symfony_project/public
    <Directory /var/www/html/symfony_project/public>
        AllowOverride All
        Require all granted
        Allow from All
        FallbackResource /index.php
    </Directory>

    ErrorLog /var/log/apache2/symfony_project_error.log
    CustomLog /var/log/apache2/symfony_project_access.log combined
</VirtualHost>
37
0 + 0
ssl
Score:0
Kamil J avatar Server
it flag
Kamil J

Depends on the permission for access to the host itself. In case the system is just handling http/https traffic and no users (except administrators) are allowed to login I would say YES it is secure design...

The question is WHO and WHEN can potentionally catch the sensitive data. The SSL termination is done on the server anyway so there is the part where the unsecured data exists anyway(e.g. RAM). So until the system is restricted to access and the unsecured data is not leaving the system (e.g. not passing the network card) the data would be safe.

SSL layer on local connection would not have big benefit as all the keys are located on the system anyway. The resource saved on de-/crypting the local traffic can be used for the higher amount of connection the system can handle...

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.